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Abstract 


This document specifies the certificate extension for including Network Function Types 
(NFTypes) for the 5G System in X.509 v3 public key certificates as profiled in КЕС 5280. 


Status of This Memo 


This is an Internet Standards Track document. 


This document is a product of the Internet Engineering Task Force (IETF). It represents the 
consensus of the IETF community. It has received public review and has been approved for 
publication by the Internet Engineering Steering Group (IESG). Further information on Internet 
Standards is available in Section 2 of RFC 7841. 


Information about the current status of this document, any errata, and how to provide feedback 
on it may be obtained at https://www.rfc-editor.org/info/rfc9310. 


Copyright Notice 


Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights 
reserved. 


This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF 
Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this 
document. Please review these documents carefully, as they describe your rights and restrictions 
with respect to this document. Code Components extracted from this document must include 
Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are 
provided without warranty as described in the Revised BSD License. 
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1. Introduction 


The 3rd Generation Partnership Project (ЗСРР) has specified several Network Functions (NFs) as 
part of the service-based architecture within the 5G System. There are 56 NF Types defined for 
3GPP Release 17; they are listed in Table 6.1.6.3.3-1 of [TS29.510], and each NF type is identified 
by a short ASCII string. 


Operators of 5G Systems make use of an internal PKI to identify interface instances in the NFs in 
a 5G System. X.509 v3 public key certificates [RFC5280] are used, and the primary function of a 
certificate is to bind a public key to the identity of an entity that holds the corresponding private 
key, known as the certificate subject. The certificate subject and the SubjectAltName certificate 
extension can be used to support identity-based access control decisions. 


This document specifies the NFTypes certificate extension to support role-based access control 
decisions by providing a list of NF Types associated with the certificate subject. The NFTypes 
certificate extension can be used by operators of 5G Systems or later. 
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2. Terminology 


The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD 
NOT", "RECOMMENDED", "NOT RECOMMENDED", "МАУ", and "OPTIONAL" in this document are to 
be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in 
all capitals, as shown here. 


3. Network Function Types Certificate Extension 


This section specifies the NFTypes certificate extension, which provides a list of NF Types 
associated with the certificate subject. 


The NFTypes certificate extension MAY be included in public key certificates [RFC5280]. The 
NFTypes certificate extension MUST be identified by the following object identifier: 


id-pe-nftype OBJECT IDENTIFIER ::- 
( iso(1) identified-organization(3) dod(6) internet(1) 
security(5) mechanisms(5) pkix(7) id-pe(1) 34 } 


This extension MUST NOT be marked critical. 


The NFTypes extension MUST have the following syntax: 


NFTypes ::- SEQUENCE SIZE (1..MAX) OF NFType 


МЕТуре ::- IA5String (SIZE (1..32)) 


The NFTypes MUST contain at least one NFType. 


Each NFType MUST contain only an ASCII string; however, the string MUST NOT include control 
characters (values 0 through 31), the space character (value 32), or the delete character (value 
127). 


Each NFType MUST contain at least one ASCII character and MUST NOT contain more than 32 
ASCII characters. 


The NFTypes MUST NOT contain the same NFType more than once. 


If the NFTypes contain more than one NFType, the NFTypes MUST appear in ascending 
lexicographic order using the ASCII values. 


The NFType uses the IA5String type to permit inclusion of the underscore character (' 7), which is 
not part of the PrintableString character set. 
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4. ASN.1 Module 


This section provides an ASN.1 Module [X.680] for the NFTypes certificate extension, and it 
follows the conventions established in [RFC5912] and [RFC6268]. 


«CODE BEGINS» 
NFTypeCertExtn 
( iso(1) identified-organization(3) dod(6) internet(1) 
security(5) mechanisms(5) pkix(7) id-mod(@) 
id-mod-nftype(106) ) 


DEFINITIONS IMPLICIT TAGS ::- 
BEGIN 


IMPORTS 
EXTENSION 
FROM PKIX-CommonTypes-2009  -- RFC 5912 
( iso(1) identified-organization(3) dod(6) internet(1) 
security(5) mechanisms(5) pkix(7) id-mod(@) 
id-mod-pkixCommon-02(57) ) ; 


-- NFTypes Certificate Extension 
ext-NFType EXTENSION ::- ( 

SYNTAX NFTypes 

IDENTIFIED BY id-pe-nftype ) 
-- NFTypes Certificate Extension OID 
id-pe-nftype OBJECT IDENTIFIER ::- 

( iso(1) identified-organization(3) dod(6) internet(1) 
security(5) mechanisms(5) pkix(7) id-pe(1) 34 ) 


-- NFTypes Certificate Extension Syntax 


NFTypes ::- SEQUENCE SIZE (1..MAX) OF NFType 
NFType ::- IA5String (SIZE (1..32)) 
END 


«CODE ENDS» 


5. Security Considerations 


The security considerations of [RFC5280] are applicable to this document. 


Some of the ASCII strings that specify the NF Types are standard. See Appendix A for values 
defined in 3GPP Release 17. Additionally, an operator MAY assign its own NF Types for use in 
their own network. Since the NF Type is used for role-based access control decisions, an 
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operator-assigned NF Type MUST NOT overlap with a value already defined in the commonly 
defined set. Use of the same ASCII string by two different operators for different roles could lead 
to confusion or incorrect access control decisions. The mechanism for an operator to determine 
whether an ASCII string associated with a NF Type is unique across operators is outside the scope 
of this document. 


The certificate extension supports many different forms of role-based access control to support 
the diversity of activities that NFs are trusted to perform in the overall system. Different levels of 
confidence that the NFTypes were properly assigned might be needed to contribute to the overall 
security of the 5G System. For example, more confidence might be needed to make access control 
decisions related to a scarce resource than implementation of filtering policies. As a result, 
different operators might have different trust models for the NFTypes certificate extension. 


6. Privacy Considerations 


In some security protocols, such as TLS 1.2 [RFC5246], certificates are exchanged in the clear. In 
other security protocols, such as TLS 1.3 [RFC8446], the certificates are encrypted. The inclusion 
of the NFTypes certificate extension can help an observer determine which systems are of most 
interest based on the plaintext certificate transmission. 


7. IANA Considerations 


For the NFTypes certificate extension defined in Section 3, IANA has assigned an object identifier 
(OID) for the certificate extension. The OID for the certificate extension has been allocated in the 
"SMI Security for PKIX Certificate Extension" registry (1.3.6.1.5.5.7.1). 


For the ASN.1 Module defined in Section 4, IANA has assigned an OID for the module identifier. 
The OID for the module has been allocated in the "SMI Security for PKIX Module Identifier" 
registry (1.3.6.1.5.5.7.0). 
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Appendix A. NFType Strings 


Table 6.1.6.3.3-1 of [TS29.510] defines the ASCII strings for the NF Types specified in 3GPP 
documents; these enumeration values in 3GPP Release 17 are listed below in ascending 
lexicographic order. This list is not exhaustive. 
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"56. DDNMF " "LMF" "PKMF" 

"БО EIR" "MBSF" "SCEF” 
"ДАМЕ" "MBSTF" ESCPA 
"ADRF" "МВ SMF" "SCSAS" 
"AF" "МВ ОРЕ" 1SCSCF" 
"AMF" "MFAF" 5ӘЕРРИ 
"AUSF" "MME" "SMF" 
"BSF" "ММРЕ" "SMSF" 
SCBCES "N31WF" "SMS. GMSC" 
BEES "NEF" "SMS. IWMSC" 
ICHE: "NRF" "ЗОВ АР" 
"DCCF" "NSACF" "SPAF" 
"DRA" "NSSAAF" "TSCTSF” 
"EASDF" "NSSF" "UCMF" 
"GBA. BSF" "NSWOF " "UDM" 
"GMLC" "NWDAF" "UDR" 
"HSS" "РАМЕ" "UDSF" 
"ICSCF" "PCF" "UPF" 
"IMS. AS" "PCSCF" 


Appendix B. Example Certificate Containing a NFTypes 


Extension 


The example certificate conforms to the certificate profile in Table 6.1.3с.3-1 of [TS33.310]. In 
addition, the NFTypes certificate is included with only one NFType, and it is "AMF". The 
SubjectAltName certificate extension contains a fully qualified domain name (FQDN) and a 
uniformResourceldentifier, which carries the NF Instance ID as specified in Clause 5.3.2 of 
[T328.571]. 


Saans BEGIN CERTIFICATE----- 
MIICODCCAlagAwIBAgIUDD5o4A4zEdfSghT2hMK-*P /E j GHlowCgYIKoZIzjO0EAwMw 
FTETMBEGA1UECgwKRXhhbXBsZSBDQTAeFwOyM j ExMj kxODEONThaFwOyMzExMj kx 
ODEONThaMDkxCzAJBgNVBAYTA1VTMSowKAYDVQQKEyE 1Z2MubW5 j NDAwLm1 j YzMx 
MS4zZ3BwbmV0d29yay5vcmcwd j AQBgcqhk j OPOIBBgUrgQQAIgNiAATJ61IFHI683 
q/JJjsJUfEiRFqGQ6uKDGJO0oqDP6wEhRAuvyEyz5pgRmz /7Mze1-*s1qcnPU9mo1v 
rIW9rjKhb/Hm8H9TPvnMQwCRCtKvCD90MkWvc /G8qyCBpCms3zNOJOi j ggFBMIIB 
PTATBggrBgEFBQcBIgQHMAUWAOFNR j AXBgNVHSAEEDAOMAwGCmCGSAF 1AwIBMDAw 
DgYDVROPAQH/BAQDAgeAMBMGA 1Ud JQQMMAoGCC sGAQUF BYMCMB0GA 1 UdDgQWBBRM 
Z5KgwYlYn885mKID55ZcEznIBzAfBgNVHSMEGDAWgBSIf6IE6Qtq;jXR2-p/xCtRh 
A4PqzNTAxBgNVHR8bK у) AoMCagJKAihiBodHRwOi8vZXhhbXBsZS5jb20vZXhhbXBs 
ZWNhLmNybDB1BgNVHREBAf8EazBpg jhhbWYxLmNsdXN@ZXIxLm51dDIuYW1mLjVn 
Yy5tbmMOMDAubWNj MzExL jNncHBuZXR3b3JrLm9yZ4YtdXJuOnV1aWQ6Z j gxzDRm 
YWUtN2R1Yy@xMWQwLWE3NjUtMDBhMGM5MWU2 YnY2MAoGCCqGSMA9BAMDA2 gAMGUC 
MEtQEut9kelkiMIMR*QzkSNGIuR30Lr23ftarLi9wMp3ZRIJYQgaAWc6ogmf3MVAp 
7QIxAKMoYAtw5srkNjE-*-Zg6CqEkf9f2banFltRuPbTp4BO0Xrazb5z/ jn3NDPM9ata 
SHUx0Q== 

Some ЕМО СЕКТЛЕТСАТЕ----- 


The following shows the example certificate. The values on the left are the ASN.1 tag (in 
hexadecimal) and the length (in decimal). 
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30 
30 
AQ 
02 


02 


30 
06 


30 
31 
30 
06 
өс 


30 
17 
(77 


30 
31 
30 
06 
13 


31 
30 
06 
13 


30 
30 
06 
06 


03 


A3 
30 
30 
06 
04 
30 
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598: 
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18 


20: 


SEQUENCE ( 


SEQUENCE ( 


[0] 


ІМТЕСЕВ 2 


) 
ІМТЕСЕВ 
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OC ЗЕ 68 ЕЗ 8C C4 75 ЕД АӨ 85 3D A1 30 AF 8F FC 
48 C6 1E 5A 
SEQUENCE ( 


OBJECT IDENTIFIER ecdsaWithSHA384 (1 2 840 10045 4 3 3) 


) 
SEQUENCE ( 
SET ( 

SEQUENCE ( 

OBJECT IDENTIFIER organizationName (2 5 4 10) 


UTF8String 'Example CA' 


) 


) 


) 
SEQUENCE ( 


UTCTime 29/11/2022 18:14:58 GMT 
UTCTime 29/11/2023 18:14:58 GMT 


) 
SEQUENCE ( 


SET 


{ 


SEQUENCE { 
OBJECT IDENTIFIER countryName (2 5 4 6) 


PrintableString 'US' 


) 
SET 


) 


SEQUENCE ( 
OBJECT IDENTIFIER organizationName (2 5 4 10) 


PrintableString '5gc.mnc400.mcc311.3gppnetwork.org' 


) 


} 
SEQUENCE { 


SEQUENCE { 


OBJECT IDENTIFIER 
OBJECT IDENTIFIER 


} 
BIT 
04 
91 
82 
5A 
Е6 
32 
E8 


} 
[3] 


SEQUENCE { 


STRING 


C9 
16 
EB 
9C 
FQ 
45 


Е8 
A1 
F2 
9C 
yp 
AF 


81 
90 
13 
F5 
53 
73 


SEQUENCE ( 
OBJECT IDENTIFIER nfTypes (1 
OCTET STRING, encapsulates ( 


SEQUENCE ( 


47 
EA 
2C 
3D 
3E 
F1 


23 
E2 
F9 
9A 
F9 
BC 


ecPublicKey (1 
secp384r1 (1 3 


AF 
83 
A6 
8D 
сс 
АВ 


37 
18 
04 
6F 
43 
20 
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AB 
9D 
66 
AC 
00 
81 


F2 
28 
CF 
85 
91 
А4 


49 
A8 
FE 
BD 
0A 
29 


3 


2 840 
132 0 


8E 
33 
сс 
АЕ 
D2 
AC 


1 


C2 
FA 
CD 
32 
AF 
DF 


10045 2 1) 


34) 


54 
CO 
ED 
A1 
08 
33 


7C 
48 
7E 
6F 
3F 
4E 


48 
51 
B3 
F1 
74 
24 


1 34) 
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30 49: 
06 i 
04 42: 
30 48: 
30 38: 
A0 36: 
A0 34: 
86 32: 
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TA5String “АМЕ! 
) 
) 


) 
SEQUENCE ( 

OBJECT IDENTIFIER certificatePolicies (2 5 29 32) 
OCTET STRING, encapsulates ( 

SEQUENCE ( 

SEQUENCE ( 
OBJECT IDENTIFIER '2 16 840 1 1013 2 1 48 48' 
) 


) 
) 


) 
SEQUENCE ( 
OBJECT IDENTIFIER keyUsage (2 5 29 15) 
BOOLEAN TRUE 
OCTET STRING, encapsulates ( 
BIT STRING 7 unused bits 
'1'B (bit 8) 
) 


й 
SEQUENCE ( 
OBJECT IDENTIFIER extKeyUsage (2 5 29 37) 
OCTET STRING, encapsulates ( 
SEQUENCE ( 
OBJECT IDENTIFIER clientAuth (136155732) 
) 
) 
) 
SEQUENCE ( 
OBJECT IDENTIFIER subjectKeyIdentifier (2 5 29 14) 
OCTET STRING, encapsulates ( 
OCTET STRING 
4C 67 92 A0 C1 89 58 9F CF 39 98 A2 03 E7 96 5C 
13 39 C8 07 


) 
) 
SEQUENCE ( 


OBJECT IDENTIFIER authorityKeyIdentifier (2 5 29 35) 


OCTET STRING, encapsulates ( 
SEQUENCE ( 
[0] 
88 7F A2 04 Е9 ОВ 6A 8D 74 76 FA 9Е F1 0A DA 61 
Ед FA ВЗ 35 
) 
) 


) 
SEQUENCE ( 
OBJECT IDENTIFIER cRLDistributionPoints (2 5 29 31) 
OCTET STRING, encapsulates ( 
SEQUENCE ( 
SEQUENCE ( 
[0] { 
Lon 
[6] 'http://example.com/exampleca.crl' 


) 
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) 
) 
) 
: ) 
ЗОИ SEQUENCE ( 
96 3% OBJECT IDENTIFIER subjectAltName (2 5 29 17) 
01 ШЕ BOOLEAN TRUE 
04 107: OCTET STRING, encapsulates ( 
30 105: SEQUENCE ( 
82 56: [2] 
: ‘amf1.cluster1.net2.amf.5gc.mnc4@@.mcc311.3gppnet' 
: 'work.org' 
86 45: [6] 
: 'urn:uuid:f81d4fae-7dec-11d0-a765-00a0c91e6bf6' 
) 
) 
} 
) 


30 10: SEQUENCE ( 
06 8: OBJECT IDENTIFIER ecdsaWithSHA384 (1 2 840 10045 4 3 3) 


: ) 
03 104: ВІТ STRING, encapsulates ( 
30 101: SEQUENCE ( 
02 48: INTEGER 
: 4B 50 12 EB 7D 91 Е9 64 88 C2 0C 47 Е4 33 91 23 
46 22 E4 77 DO BA F6 DD FB 5A AC B8 BD СӨ СА 77 
: 65 12 09 61 08 1A 01 67 3A 82 67 F7 31 50 29 ED 
02 49: INTEGER 
Е 00 A3 28 60 ӨВ 70 Еб СА Е4 36 31 ЗЕ 66 ӨЕ 82 A8 
49 1F F5 FD 9B 6A 71 65 B5 1B 8F 6D 3A 78 07 45 
EB 6B 3E 73 FE 39 F7 34 33 CC F5 AB 5A 48 75 31 
39 
) 
) 
) 
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